What is the Extended Validation (EV) certificate?
We need to use encrypted communication protocols like SSL/TLS and SSH to transfer sensitive data between two hosts. And, public-key cryptography is used to initiate communication in those protocols.
In a secured protocol like SSL/TLS or SSH, usually the client initiates the connection. The server sends its digital certificates to the client. A digital certificate is basically an electronic document that is issued by an authority called the Certificate Authority or CA. And it vouches for the authenticity of the public key of the entity.
An Extended Validation certificate or EV certificate is also a digital certificate issued by a Certificate Authority or CA. An EV certificate can safeguard users from attacks like phishing in a better way than a commercially available Domain Validated Certificate or DV certificate.
What is the Domain Validated (DV) certificate?
A Domain Validated (DV) certificate is also a digital certificate issued by a CA. However, DV certificates are commercially more economical and involve relatively less verification of the identity of the applicants. In Domain Validated certificates, most of the time, the identity verification of the applicant is done in an automated way. It verifies only the registration of the website’s domain.
Security concerns of Domain Validated (DV) certificates
It is easier for an attacker to exploit Domain Validated (DV) certificates than Extended Validation (EV) certificates. For example, an attacker can easily register a domain named facebok.com (please note the difference in spelling) and create a malicious webpage that looks very similar to the authentic website. Then, they can send the link to their website to victims using social engineering. Thus, they can trick victims into providing login credentials on the fraudulent website, following which they can easily steal sensitive data.
As the previous versions of web browsers could not differentiate between fully validated SSL certificates or EV certificates and Domain Validated SSL certificates or DV certificates, it would become much more difficult for users to identify this type of phishing attack.
The difference between Extended Validation (EV) certificates and Domain Validated (DV) certificates
If we think from an encryption perspective, there is no difference between Extended Validation (EV) …






0 Comments